DPSCS IFB - BPM029040 - Mainframe Equipment Maintenance - Final 022723.docx

Mainframe Equipment Maintenance Solicitation #: BPM029040 IFB Document

State of Maryland Department of Public Safety and Correctional Services (DPSCS)

INVITATION FOR BIDS (IFB)

Mainframe Equipment Maintenance IFB Number: BPM029040

Issue date: February 27, 2023

NOTICE TO BidderS

SMALL BUSINESS RESERVE PROCUREMENT

This is a Small Business Reserve Procurement for which award will be limited to certified small business vendors. Only businesses that meet the statutory requirements set forth in State Finance and Procurement Article, §§14-501 —14-505, Annotated Code of Maryland, and that are certified by the Governor’s Office of Small, Minority & Women Business Affairs (GOSBA) Small Business Reserve Program are eligible for award of a contract.

NOTICE

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace (eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

Minority Business Enterprises Are Encouraged to Respond to this Solicitation.

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation. Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information Summary Sheet below for contact information).

Title: Mainframe Equipment Maintenance Solicitation No: BPM029040

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

· Other commitments preclude our participation at this time

· The subject of the solicitation is not something we ordinarily provide

· We are inexperienced in the work/commodities required

· Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

· The scope of work is beyond our present capacity

· Doing business with the State is simply too complicated. (Explain in REMARKS section)

· We cannot be competitive. (Explain in REMARKS section)

· Time allotted for completion of the Bid is insufficient

· Start-up time is insufficient

· Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

· Bid requirements (other than specifications) are unreasonable or too risky (Explain in REMARKS section)

· MBE or VSBE requirements (Explain in REMARKS section)

· Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory. (Explain in REMARKS section)

· Payment schedule too slow

· Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS: ____________________________________________________________________________________ Vendor Name: ________________________________ Date: _______________________ Contact Person: _________________________________ Phone (____) _____ - _________________ Address: ______________________________________________________________________ E-mail Address: ________________________________________________________________ State of Maryland Department of Public Safety and Correctional Services (DPSCS) Key Information Summary Sheet

Department. of Public Safety and Correctional Services 6776 Reisterstown Road Baltimore, MD 21215 e-mail:

Office Phone:

arthur.petersen@maryland.gov 410-336-7623

Bidders are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page iv).

Maryland Correctional Enterprises (MCE), 7275 Waterloo Road, Jessup, MD 20794

Minimum Qualifications Bidder Minimum Qualifications As part of the determination to be considered responsive, the Bidder must document in its Bid that it satisfies the following Minimum Qualifications:

1.1.1 The Bidder shall have two Computer Network Specialists who meet the following minimum qualification criteria:

1.1.2.1 Have graduated from an accredited high school or be in possession of a valid high school equivalency certificate.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid documentation including a diploma or a high school equivalency certificate.

1.1.2.2 Possess training and experience equivalent to the Computer Network Specialist – I (#006680) job classification of the Maryland Department of Budget and Management (DBM) presented in Attachment Q.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid current resumes of the proposed candidates.

1.1.2.3 The Bidder shall document and verify that the proposed personnel have the skills, experience, and training required to perform the required maintenance and repair services on the equipment and systems listed in Attachment P.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid documentation that verifies that the candidates have provided maintenance and performed repairs on mainframe equipment and related peripheral systems listed in Attachment P.

THE REMAINDER OF THIS PAGE HAS BEEN INTENTIONALLY LEFT BLANK.

Contractor Requirements: Scope of Work Summary Statement The Department of Public Safety and Correctional Services ("Department") is issuing this Invitation for Bids (IFB) in order to obtain the services specified in Section 2.

It is the State’s intention to obtain goods and services, as specified in this IFB, from a Contract between the selected Bidder and the State.

The Department intends to make a single award for the work under this IFB. See IFB Section 4.9 Award Basis for more Contract award information.

A Bidder, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Bidder (the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

Maryland State agencies and local governments as defined in Finance and Procurement §13-110(a) and nonprofit entities within the State of Maryland may purchase from the Contractor goods or services covered by the Contract at the same prices chargeable to the State. All such purchases by non-executive branch entities, non-State governments, government agencies or nonprofit entities:

a) Shall constitute Contracts between the Contractor and that entity;

b) Shall not constitute purchases by the State or State agencies under the Contract;

c) Shall not be binding or enforceable against the State; and

d) May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

All Contract prices, terms, and conditions must be provided to any Maryland local government or nonprofit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

Background and Purpose The foundation of the Department’s information technology infrastructure is provided by two IBM mainframe systems, plus their associated peripheral equipment, located at the Public Safety Data Center (1201 Reisterstown Rd, Bldg. F, Pikesville, MD 21208) and at Maryland Correctional Enterprises (7275 Waterloo Rd. Jessup, MD 20794). In addition to handling the Department’s day-to-day business operations, these systems are vital for the secure management, archiving, analysis of and access to criminal record databases for the Department and other local, state, and federal law enforcement and criminal justice agencies. The Department must ensure that its mainframes and peripheral equipment are maintained and functioning to provide the highest level of performance and availability, 24 hours per day, 7 days per week, 365 days per year.

Project Goals

a) The goal of this IFB is to obtain the services of a Contractor to provide annual maintenance and repair services to ensure that the Department’s mainframe infrastructure provides maximum 24/7/365 availability.

b) In order to continuously execute mission critical data processing operations, the Contractor shall minimize downtime that may arise from inadequate maintenance or equipment failure.

Current Environment The Department currently uses an IBM mainframe-based enterprise server system, including Direct Access Storage Devices (DASD) tape subsystems, and associated peripherals.

Existing Hardware A complete list of existing mainframe hardware and their location is provided in Attachment P.

Department Responsibilities

1. The Department will provide normal office working facilities and equipment reasonably necessary for Contractor performance under the Contract. Any special requirements (e.g., reprographic services, computer time, key data entry) shall be identified.

1. The Department is responsible for providing required information, data, documentation, and test data to facilitate the Contractor’s performance of the work and will provide such additional assistance and services as is specifically set forth.

Responsibilities and Tasks

2.3.1 The Contractor shall:

A. Provide both scheduled and on-call services (24 hours per day, 7 days per week, 365 days per year) to the Department and the Maryland Correctional Enterprises (MCE), Jessup, MD for maintenance and repair services on one mainframe computer (IBM AS400) and related peripherals and accessories. The same services shall be provided for mainframe related peripherals and accessories at the Public Safety Data Center, Pikesville, MD (Section 2.2). When requested to provide on-site maintenance or repairs the Contractor shall travel to these two (2) locations as required.

B. Provide preventive maintenance and repairs for the Department’s and MCE’s mainframe information processing equipment as presented in Attachment P: DPSCS Mainframe Equipment Inventory.

1. The Contractor shall perform preventive maintenance according to the schedule and process of the original equipment manufacturer (OEM) for each item of equipment identified in Attachment P.

2. The Contractor shall inform the Contract Manager when a part is malfunctioning or damaged. The Contract Manager, in consultation with the Contractor, will decide if the part will be repaired or replaced.

3. If the Contractor determines that equipment can no longer be serviced due to the non-availability of parts, or if the Contractor and the Contract Manager agree that no further repairs can be performed to return the equipment to normal operation, it will be the option of the Contract Manager to request a replacement.

C. Equipment no longer under manufacturer’s warranty may be added to the contract or equipment may be removed from the contract, based on the Department’s determination that the equipment has reached end-of-life (EOL) status and can no longer function as required.

D. The Contract Manager will determine if any equipment changes that have a material impact on the cost and level of work will be assessed to determine compliance with the contract and determine whether a change order or a contract modification is appropriate. The proposed cost to maintain and repair all equipment listed in Attachment P shall be all inclusive of labor and any required parts necessary to maintain or repair equipment.

E. Provide the Department with a single point of contact to include name, phone, and email address for all mainframe equipment maintenance. The Contract Manager or designee is the Contractor’s single point of contact with the Department for all communication concerning the work to be performed under this contract.

F. Provide a helpdesk ticketing system with a unique identifier for each problem as defined in Section 2.5.1 reported during the term of the Contract. At a minimum each help desk ticket shall:

1. Have a unique identification number to track the ticket from initial opening to the resolution of the ticket.

2. Provide a date and time stamp when notification of the ticket is received from the Department.

3. Provide a brief concise description of the problem.

4. Identify the severity of the problem (Emergency, High, Medium or Low as defined in Section 2.5.8.

5. Provide notification of updates to the ticket and final resolution of the ticket.

G. Ensure that all manufacturers’ announced engineering changes and diagnostic routines are installed within 30 days from the date of availability from the manufacturer. Installation of equipment shall be scheduled with the Contract Manager or designee appointed by the Department.

H. Shall provide a Remote Support Facility (RSF) to enable the Contractor to communicate remotely with the AS400 and 3500 series tape drives/library devices and related equipment in order to receive alerts of equipment malfunctions.

I. Adhere to the equipment manufacturer’s preventive maintenance schedule (Frequency of maintenance.) and procedures plus provide the Contract Manager with a recommended preventive maintenance calendar, process, and procedure for all equipment listed.

J. Ensure that all replacement parts are new and from the Original Equipment Manufacturer (OEM) or certified by the OEM to be equivalent as new. Contractor shall:

1. Ensure adequate supply of parts in the Baltimore-Metropolitan area in order to keep down-time to a minimum;

2. Ensure parts prices are quoted in terms of a minimum discount of twenty percent from a current published price list including manufacturer’s current published catalog or current published price list and ensure that replacement parts price increases are not charged to the Department;

3. Provide with your invoice, a listing of repair parts, including manufacturers, that the Contractor maintains in inventory;

4. Verify repair parts cost with copies of the proof of purchase invoices from the parts suppliers/manufacturers attached to the Contractor’s monthly invoices for work completed;

5. Provide the Department with the manufacturers’ current price list for the repair parts on a quarterly basis.

K. Update existing documented processes and procedures for all equipment maintenance to include detailed, step-by-step processes and procedures in Microsoft Word.

L. Perform other duties within the general scope of this IFB, as directed by the Contract Manager.

Figure 1: Work Products

· Contact Names(s) (Primary & Backup)

· Physical Address(es)

· Email Address(es)

· Business phone number(s)

· Cell phone number(s)

Initial: NTP + 5 days

Updates: Annually

Changes: NLT 10 days of personnel change

· A maintenance schedule

· Type of maintenance

· Frequency

· Status of maintenance activities Initial: NTP + 5 days

Updates: Quarterly

Changes: NLT 5 days of change

Updates: Quarterly

Changes: NLT 5 days of change

2.3.2 Required Project Policies, Guidelines, and Methodologies The Contractor shall comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically. The Bidder shall review all links provided below and confirm its agreement to comply in its response.

It is the responsibility of the Contractor to ensure adherence to and remain abreast of new or revised laws, regulations, policies, standards and guidelines affecting project execution. These include, but are not limited to:

A. The Department of Maryland System Development Life Cycle (SDLC) methodology at: https://doit.maryland.gov/policies/Pages/default.aspx;

1. The Department of Maryland Information Technology Security Policy and Standards at: https://doit.maryland.gov/policies/Pages/default.aspx;

A. The Department of Maryland Information Technology Non-Visual Standards at: https://doit.maryland.gov/policies/Pages/nva.aspx;

B. Work performed outside of the U.S. is not permitted under this TORFP: As described in Section 3.7 Security Requirements, Offerors are advised that any work conducted, data processed or storage of data outside of the continental U.S. is prohibited.

Deliverables There are no deliverables required under this IFB.

Service Level Agreement (SLA) The Contractor shall provide a toll free telephone number for the help desk to the Department for placing service calls.

The Contractor shall not provide automated-voice responses to the Department’s calls as depicted in the Service Level Agreement. The Contractor shall have access via pager and/or cell phone to its technical support and field personnel so that the required technical support personnel may be contacted regardless of location.

Definitions

1. A “Problem” is defined as any situation or issue reported via a help desk ticket that is related to the system operation that is not an enhancement request.

D. “Problem resolution time” is defined as the period of time from when the help desk ticket is opened to when it is resolved.

E. Monthly Charges: for purposes of SLA credit calculation, Monthly Charges are defined as the charges invoiced during the month of the breach for the monthly fixed services as set forth in Attachment B, IFB Financial Proposal Form.

SLA Requirements The Contractor shall:

A. Be responsible for complying with all performance measurements and shall also ensure compliance by all subcontractors.

B. Meet the Problem response time and resolution requirements as defined in Section 2.5.8.

C. Provide a monthly report to monitor and detail response times and resolution times.

D. Log Problems into the Contractor-supplied help desk software and assign an initial severity (Emergency, High, Medium or Low as defined in Section 2.5.8).

E. Respond to and update all Problems, including recording when a Problem is resolved and its resolution. Appropriate Department personnel shall be notified when a Problem is resolved.

F. The Department shall make the final determination regarding Problem severity.

G. Contractor shall review any Problem with Department to establish a remediation plan and relevant target dates.

Service Level Agreement Service Credits Time is an essential element of the Contract; therefore, it is important that the work is vigorously prosecuted until completion. For work that is not completed within the time(s) specified in Section 2.5.8 Service Level Response Performance Requirements, the Contractor shall be liable for service credits in the amount(s) provided for in this Contract. provided, however, that due account shall be taken of any adjustment of specified completion time(s) for completion of work as granted by approved change orders.

The parties agree that any assessment of service credits shall be construed and treated by the parties, not as imposing a penalty upon the Contractor, but as compensation to the Department for the Contractor’s failure to timely complete work under this Contract.

SLA Effective Date (SLA Activation Date) SLAs set forth herein shall be in effect beginning with the commencement of monthly services as of the completion of the implementation of the Contract.

Beginning on the SLA Activation Date, for any performance measurement not met during the monthly reporting period, the SLA credit for that individual measurement shall be applied to the Monthly Charges.

Service Level Reporting A. Contractor performance will be monitored by the Department.

B. The Contractor shall provide detailed monthly reports evidencing the attained level for each SLA.

C. The Contractor shall provide a monthly summary report for SLA performance.

D. Monthly reports shall be delivered via e-mail to the Contract Monitor not more than seven (7) calendar days after the last day of the preceding month for which performance is being reported.

E. If any of the performance measurements are not met during the monthly reporting period, the Contractor will be notified of the standard that is not in compliance.

SLA Service Credits The Contractor’s failure to comply with an SLA will result in a credit, as service credits and not as a penalty, to the Monthly Charges payable by the Department during the month of the breach. The credits will be cumulative for each missed service requirement. The Department, at its option for amount due the Department as service credits, may deduct such from any money payable to the Contractor, or may bill the Contractor as a separate item. In the event of a catastrophic failure affecting the entire solution, all affected SLAs shall be credited to the Department. In no event shall the aggregate of all SLA credits paid to the Department in any calendar month exceed 25% of the Monthly Charges.

Example: If the Monthly Charges were $100,000 and one SLA were missed, with an applicable 4% credit, the credit to the monthly invoice would be $4,000, and the Department would pay a net Monthly Charge of $96,000.

Root Cause Analysis If the same SLA measurement yields an SLA credit more than once, the Contractor shall conduct a root cause analysis. Such root cause analysis shall be provided within 30 days of the second breach, and every breach thereafter.

In addition, for each ‘Emergency’ or ‘High’ priority Problem, the affected parties will perform a root cause analysis and institute a process of problem management to prevent recurrence of the issue.

Service Level Response Performance Requirements The Contractor shall comply with the response performance requirements in the following table and provide a monthly report to monitor and detail response and resolution times.

Full Outage

Scheduled Downtime/ Maintenance

*Definition of Normal Department Business Hours are 7:00 am to 7:00 pm Monday through Friday.

Contractor Requirements: General Contract Initiation Requirements A. Contractor shall schedule and hold a kickoff meeting within 10 Business Days of NTP Date. At the kickoff, the Contractor shall furnish an updated Maintenance Schedule describing the activities for the Contractor, the Department, and any third parties for fully transitioning to the Contractor’s solution. Also, the Contractor shall:

1. Introduce its Project Manager and other staff assigned to the Contract and establish the chain of communications with the Department.

2. Provide an updated Project Schedule describing the goals to be accomplished for successfully implementing the transition-start-up period.

3. Introduce the MBE and other subcontractors, if applicable, detailing their roles in executing the Scope of Work and finalizing the goal and utilization reporting requirements.

End of Contract Transition The Contractor shall provide transition assistance as requested by the State to facilitate the orderly transfer of services to the State or a follow-on contractor, for a period up to <<60>> days prior to Contract end date, or the termination thereof. Such transition efforts shall consist, not by way of limitation, of:

a) Provide additional services and support as requested to successfully complete the transition;

b) Maintain the services called for by the Contract at the required level of proficiency;

c) Provide updated System Documentation (see Attachment P.), as appropriate; and

d) Provide current operating procedures (as appropriate).

The Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the Contract Monitor. The Contract Monitor may provide the Contractor with additional instructions to meet specific transition requirements prior to the end of the Contract.

The Contractor shall ensure that all necessary knowledge and materials for the tasks completed are transferred to the custody of State personnel or a third party, as directed by the Contract Monitor.

The Contractor shall support end-of-Contract transition efforts with technical and project support to include but not be limited to:

a) The Contractor shall provide a draft Transition-Out Plan not more than 120 Business Days in advance of Contract end date.

b) The Transition-Out Plan shall address at a minimum the following areas:

1) Any staffing concerns/issues related to the closeout of the Contract;

2) Communications and reporting process between the Contractor, the Department and the Contract Monitor;

3) Security and system access review and closeout;

4) Any hardware/software inventory or licensing including transfer of any point of contact for required software licenses to the Department or a designee;

5) Any final training/orientation of Department staff;

6) Connectivity services provided, activities and approximate timelines required for Transition-Out;

7) Knowledge transfer, to include:

a) A working knowledge of the current system environments;

b) Review with the Department the procedures and practices that support the business process and current system environments;

c) Working knowledge of all technical and functional matters associated with the solution, its architecture, data file structure, interfaces, any batch programs, and any hardware or software tools utilized in the performance of the Contract;

d) Documentation that lists and describes all hardware and software tools utilized in the performance of the Contract;

e) A working knowledge of various utilities and corollary software products used in support and operation of the services provided;

8) Plans to complete tasks and any unfinished work items (including open change requests, and known bug/issues); and

9) Any risk factors with the timing and the Transition-Out schedule and transition process. The Contractor shall document any risk factors and suggested solutions.

b) The Contractor shall ensure all documentation and data including, but not limited to, System Documentation and current operating procedures, is current and complete with a hard and soft copy in a format prescribed by the Contract Monitor.

c) The Contractor shall provide copies of any current daily and weekly back-ups to the Department or a third party as directed by the Contract Monitor as of the final date of transition, but no later than the final date of the Contract.

Invoicing

3.3.1 General

1. The Contractor shall e-mail the original of each invoice and signed authorization to invoice to the Contract Monitor Moses Walker at e-mail address: moses.walker@maryland.govand Ms. Rita Walton at e-mail address: accountspayable.osec@maryland.gov.

1. All invoices for services shall be verified by the Contractor as accurate at the time of submission.

1. An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) State assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

g) Invoices that contain both fixed price and time and material items shall clearly identify each item as either fixed price or time and material billing.

h) The Department reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the Department with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

i) Any action on the part of the Department, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.04.

j) The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

k) Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

1.1.1 Invoice Submission Schedule The Contractor shall submit invoices in accordance with the following schedule:

1. For items of work for which there is one-time pricing (see Attachment B –Bid Form) those items shall be billed in the month following the acceptance of the work by the Department.

1. For items of work for which there is annual pricing, see Attachment B–Bid Form, those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

Time and Materials Invoicing

1. All time and material invoices shall be accompanied by a signed timesheet as described below. Include for each person covered by the invoice the following, individually listed per person: name, hours worked, hourly labor rate, invoice amount and a copy of each person’s timesheet for the period signed by the Contract Monitor.

1. Time Sheet Reporting Within three (3) Business Days after the 15th and last days of the month, the Contractor shall submit a semi-monthly timesheet for the preceding half month providing data for all Contractor Personnel / employees / resources working under the Contract.

At a minimum, each semi-monthly timesheet shall show:

1) Title: “Time Sheet for DPSCS Contract – Q00B3600001”;

2) Issuing company name, address, and telephone number;

3) For each Contractor employee /resource:

a) Contractor employee / resource name, and

b) For each period ending date, e.g., “Period Ending: mm/dd/yyyy” (Periods run 1st through 15th, and 16th through last day of the month.):

i) Tasks completed that week and the associated deliverable names and ID#s;

ii) Number of hours worked each day;

iii) Total number of hours worked that Period;

iv) Period variance above or below 40 hours;

v) Annual number of hours planned under the Contract;

vi) Annual number of hours worked to date; and

vii) Balance of hours remaining;

viii) Annual variance to date (Sum of periodic variances); and

4) Signature and date lines for the Contract Monitor.

5) Time sheets shall be submitted to the Contract Monitor prior to invoicing. The Contract Monitor shall sign the timesheet to indicate authorization to invoice.

For the purposes of the Contract an amount will not be deemed due and payable if:

1. The amount invoiced is inconsistent with the Contract;

1. The proper invoice has not been received by the party or office specified in the Contract;

1. The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

1. The item or services have not been accepted;

1. The quantity of items delivered is less than the quantity ordered;

1. The items or services do not meet the quality requirements of the Contract;

1. The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the Contract and compliance with its provisions.

Travel Reimbursement Travel will not be reimbursed under this IFB.

Liquidated Damages MBE Liquidated Damages Inapplicable because there is no MBE goal for this IFB.

Liquidated Damages other than MBE This section does not apply to this IFB.

Disaster Recovery and Data This section does not apply to this IFB.

Insurance Requirements The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

The following type(s) of insurance and minimum amount(s) of coverage are required:

1. Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $3,000,000 annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

1. Crime Insurance/Employee Theft Insurance - to cover employee theft with a minimum single loss limit of $1,000,000 per loss, and a minimum single loss retention not to exceed $10,000. The State of Maryland and the Department should be added as a “loss payee.”

1. Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation Insurance and professional liability.

All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing, if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the Contractor shall provide certificates of insurance annually, or as otherwise directed by the Contract Monitor.

The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

Security Requirements The following requirements are applicable to the Contract:

Employee Identification

1. Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

1. Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

1. Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

1. The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

Security Clearance / Criminal Background Check

a) A criminal background check for each Contractor Personnel providing maintenance, diagnostics, troubleshooting, or repair services for the Department’s information technology infrastructure either remotely or on-site shall be completed before the start of work on the Contract.

b) The Contractor shall obtain at its own expense a Criminal Justice Information System (CJIS) State and federal criminal background check, including fingerprinting, for all Contractor Personnel listed in sub-paragraph A. This check may be performed by a public or private entity.

c) The Contractor shall provide certification to the Department that the Contractor has completed the required criminal background check described in this IFB for each required Contractor Personnel prior to assignment, and that the Contractor Personnel have successfully passed this check.

d) Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check. Decisions of the Contract Monitor as to acceptability of a candidate are final. The State reserves the right to refuse any individual Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

e) The CJIS criminal record check of each Contractor Personnel who will work on State premises shall be reviewed by the Contractor for convictions of any of the following crimes described in the Annotated Code of Maryland, Criminal Law Article:

1) §§ 6-101 through 6-104, 6-201 through 6-205, 6-409 (various crimes against property);

2) any crime within Title 7, Subtitle 1 (various crimes involving theft);

3) §§ 7-301 through 7-303, 7-313 through 7-317 (various crimes involving telecommunications and electronics);

4) §§ 8-201 through 8-302, 8-501 through 8-523 (various crimes involving fraud);

5) §§9-101 through 9-417, 9-601 through 9-604, 9-701 through 9-706.1 (various crimes against public administration); or

6) a crime of violence as defined in CL § 14-101(a).

f) Contractor Personnel with access to systems supporting the State or to State data who have been convicted of a felony or of a crime involving telecommunications and electronics from the above list of crimes shall not be permitted to work on State premises under the Contract; Contractor Personnel who have been convicted within the past five (5) years of a misdemeanor from the above list of crimes shall not be permitted to work on State premises.

g) A particular on-site location covered by the Contract may require more restrictive conditions regarding the nature of prior criminal convictions that would result in Contractor Personnel not being permitted to work on those premises. Upon receipt of a location’s more restrictive conditions regarding criminal convictions, the Contractor shall provide an updated certification regarding the Contractor Personnel working at or assigned to those premises.

On-Site Security Requirement(s)

1. For the conditions noted below, Contractor Personnel may be barred from entrance or leaving any site until such time that the State’s conditions and queries are satisfied.

30. Contractor Personnel may be subject to random security checks when entering and leaving State secured areas. The State reserves the right to require Contractor Personnel to be accompanied while in secured premises.

30. Some State sites, especially those premises of the Department of Public Safety and Correctional Services, require each person entering the premises to document and inventory items (such as tools and equipment) brought onto the site, and to submit to a physical search of his or her person. Therefore, Contractor Personnel shall always have available an inventory list of tools being brought onto a site and be prepared to present the inventory list to the State staff or an officer upon arrival for review, as well as present the tools or equipment for inspection. Before leaving the site, the Contractor Personnel will again present the inventory list and the tools or equipment for inspection. Upon both entering the site and leaving the site, State staff or a correctional or police officer may search Contractor Personnel. Depending upon facility rules, specific tools or personal items may be prohibited from being brought into the facility.

1. Any Contractor Personnel who enters the premises of a facility under the jurisdiction of the Department may be searched, fingerprinted (for the purpose of a criminal history background check), photographed and required to wear an identification card issued by the Department.

1. Further, Contractor Personnel shall not violate Md. Code Ann., Criminal Law Art. Section 9-410 through 9-417 and such other security policies of the agency that control the facility to which the Contractor Personnel seeks access. The failure of any of the Contractor Personnel to comply with any provision of the Contract is sufficient grounds for the State to immediately terminate the Contract for default.

Information Technology The Contractor shall:

32. Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

32. Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

32. The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information Systems and Information Technology and (ii) comply with and adhere to the State IT Security Policy and Standards as each may be amended or revised from time to time. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

Data Protection and Controls A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”). Such Security Best Practices shall comply with an accepted industry standard, such as the NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 3.7.5.

2) Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides https://www.cisecurity.org/ Security Technical Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3)…